Refusal before decoding: Detecting and exploiting refusal signals in LLM intermediate-layer activations

The researchers found that LLM refusal behavior can be linearly decoded from intermediate-layer activations well before the final layer, and on this basis propose a probe-guided jailbreak method, Mechanistic AutoDAN. They use linear probes trained on residual-stream activations at each Transformer layer to predict refusal, and in AutoDAN's genetic prompt search loop replace full model fitness evaluation with partial forward passes plus probe scoring. On the evaluated models, the method's attack success rate is comparable to the original AutoDAN, single-round search time is reduced by up to 72%, and cross-model transfer is equal or higher under some configurations. The authors also find that the benefit of probe guidance grows with model scale, being especially effective for larger, more robust models.